Re: [Danish] [EXT] Re: IoT Device Identification with TLSA via Danish

FWIW, I'm a fan of immutable DNS names and rotating certs. If the device
can rotate its own certificate with the CA, then an automation component
between the CA and DNS server can manage the rotation for DANE via TLSA
records.

It only gets easier over time to guess private keys. Being able to rotate
them would be a big advantage over the lifetime recommendation in IEEE
802.1AR for device certs.

On Tue, Jun 15, 2021 at 12:57 PM Michael Richardson <mcr+ietf@sandelman.ca>
wrote:

>
> Viktor Dukhovni <ietf-dane@dukhovni.org> wrote:
>     >> {I personally think that this is a negative of DANISH.  Maybe it's
> not
>     >> a core aspect of it, but it seems like it to me.}
>
>     > If the key is immutable for the lifetime of the device, and not
>     > strongly protected against extraction by its previous owner, then
>     > change of ownership potentially leaves the new owner unsure whether
>     > the device is still "trustworthy" (assuming it was ever trustworthy
>     > to begin with, ...walks away muttering something about supply chain
>     > security under his breath...)
>
> Yes, that's the point.
> The immutability for the lifetime of the device is a source of great power,
> but also a problem.
>
> We should consider if we can use either subcerts/delegated certificates
> here
> in a useful way.
>   https://datatracker.ietf.org/doc/draft-ietf-acme-star-delegation/
>   https://datatracker.ietf.org/doc/draft-ietf-tls-subcerts/
>
> I have considered that using them would be appropriate when the IDevID is
> stored at the far side of a really slow I2C/SPI bus into a TPM.  You don't
> want
> to use it for "day to day" operations in that case.
>
> --
> Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 IøT consulting )
>            Sandelman Software Works Inc, Ottawa and Worldwide
> --
> Danish mailing list
> Danish@ietf.org
> https://www.ietf.org/mailman/listinfo/danish
>

-- 

*Ash Wilson* | Technical Director
*e:* ash.wilson@valimail.com

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.